An older lattice puzzle about fractions of small polynomials.
The idea: The private key is two polynomials with tiny coefficients, f and g. The public key is their ratio h = g / f, which looks like a random polynomial with big coefficients. Going back from h to a small f and g is a lattice problem: the small pair is a very short vector in a lattice defined by h. Whoever knows the small pair holds a good description of that lattice, which Falcon uses as its signing trapdoor.
Why it matters: Powers the compact Falcon signature.
The details
Given h = g / f in a polynomial ring, where f and g have small coefficients, recover f and g. Proposed in 1996[1], it is one of the oldest lattice problems used in cryptography.
It is the basis of FN-DSA (Falcon) signatures[2] and of NTRU encryption (KE).
This assumption gives key exchange on its own, so it needs more than one-way functions and falls if public-key encryption is impossible.
TD
This assumption gives trapdoor functions on its own (computable by anyone, invertible only with a secret), so it falls if trapdoor functions don't exist. Schemes built on it need not use a trapdoor: ElGamal doesn't.
References
Jeffrey Hoffstein, Jill Pipher and Joseph H. Silverman. NTRU: A ring-based public key cryptosystem. Algorithmic Number Theory, 1998. doi:10.1007/bfb0054868
Pierre-Alain Fouque, Jeffrey Hoffstein, Paul Kirchner and Vadim Lyubashevsky. Falcon: Fast-Fourier Lattice-based Compact Signatures over NTRU. Falcon team, 2020. falcon-sign.info